Data security
AssigneeAtmel Corporation
InventorsMajid Kaabouch, Alexandre Croguennec, Carine Lefort
Life of this patent
Estimating the term…
Abstract
This document discloses data security systems and methods of securing data. A cache memory can be connected between a decryption engine and a central processing unit (“CPU”) to increase security of encrypted data that is stored in a datastore. The decryption engine can retrieve the encrypted data from the datastore, decrypt the data, and store the decrypted data in the cache. In turn, the decrypted data can be accessed by the CPU. The data can be encrypted with a secret key, so that decryption can be performed with the secret key. The key can be varied based on a memory address associated with the data. The key can be protected by restricting direct access to the decryption engine by the CPU.
Claims18
A method of securing data, comprising:
- receiving a first data fetch instruction;
- retrieving data from a predefined memory window in response to the first data fetch instruction, wherein the data is encrypted with a cipher that is based on a memory sub-window address and a secret key;
- decrypting the retrieved data with the cipher;
- providing access to the decrypted data in a memory cache that is independent of the predefined memory window;
- and
- maintaining the decrypted data in the memory cache until a second data fetch instruction that requests an instruction that is not maintained in the memory cache is received.
A data security system, comprising:
- a central processing unit;
- a first datastore comprising a memory window defined in a memory structure, wherein the memory window comprises a portion of memory that is defined by a start address and an end address;
- a decryption engine coupled to the memory structure to decrypt data retrieved from the memory window with a cipher that is based on a memory sub-window address and a secret key;
- and
- a second datastore comprising a memory cache coupled to the decryption engine and the central processing unit, the second datastore operable to store the decrypted data for execution by the central processing unit, wherein the memory cache stores the decrypted data until the central processing unit requests data that is not stored in the second datastore.
A data security device comprising:
- means for retrieving data from a predefined memory window in response to a first fetch instruction received from a central processing unit, wherein the data is encrypted with a cipher that is based on a memory sub-window address and a secret key;
- means for decrypting the retrieved data using the cipher, wherein the decrypting is performed by a decryption engine that is independent of the central processing unit;
- means for providing access to the decrypted data in a memory cache that is independent of the predefined memory window;
- and
- means for maintaining the decrypted data in the memory cache until a second fetch instruction that requests an instruction that is not maintained in the memory cache is received.
A method, comprising:
- defining a memory window in a datastore to store encrypted data;
- defining at least one memory sub-window comprising one or more memory blocks of the memory window;
- and
- storing encrypted data in the memory sub-window, wherein the encrypted data is encrypted with an encryption key that is based on the memory sub-window address that corresponds to a memory location to which the data is stored.
Dependencies are inferred from the claim text.